Thought Leadership
A framework operated as Phishing-as-a-Service called BigBear 2.0 has bypassed multi-factor authentication at 258 organizations, stealing more than 5,000 Microsoft 365 credentials in the process.
Researchers at cybersecurity firm CloudSEK gained administrative access to the associated control panel and found 42 managed VPS servers, all of which were targeted at Microsoft 365 accounts.
According to the researchers, the campaign uses an Evilginx2-based Adversary-in-the-Middle framework to intercept passwords as well as already authenticated session cookies, allowing attackers to take over accounts even after multi-factor authentication has been successfully completed. To achieve this, BigBear uses a configuration called “Offy” to position a proxy server between the victim and the actual, legitimate Microsoft authentication infrastructure, allowing both credentials including multi-factor verification as well as session cookies to be intercepted and replayed via an API in order to hijack the victim’s authenticated session. CloudSEK explained in a report shared with BleepingComputer:
“The panel exfiltrated 5,137 credential records, including 474 complete multi-factor bypasses.”
CloudSEK
Added to this were 1,032 passwords stored in plaintext as well as 4,148 session cookies, affecting 3,331 unique victim IP addresses across more than 40 countries, with the operation remaining active at the time of the investigation. The multi-tenant phishing panel is reportedly rented out to at least five affiliate operators, identified via live Telegram bots through which each operator receives stolen credentials in real time. Out of a total of 461 organizations recorded in the broader target dataset, CloudSEK reported that 258 exhibited at least one fully completed compromise with bypassed multi-factor authentication.
Targeted weakening of modern authentication methods
CloudSEK also discovered that BigBear deploys custom JavaScript code specifically designed to disrupt FIDO2 or WebAuthn authentication by disabling the corresponding browser function to push victims toward weaker login methods instead. To increase its success rate, the platform also uses geographically matched residential proxies across 69 countries, aligning the victim’s location with that of a local IP address so that Microsoft’s own authentication servers do not flag the activity as suspicious.
CloudSEK stated that it notified both law enforcement agencies and several affected organizations, sharing the affected credentials as part of a responsible disclosure process. The actual administrative panel of the service remained online at the time of the investigation, while the underlying phishing infrastructure had already been offline for nearly three weeks.
Recommended protective measures
Organizations potentially affected by BigBear should reset compromised passwords, revoke active sessions, renew access tokens, and enforce re-authentication for high-privilege accounts. The use of phishing-resistant FIDO2 or WebAuthn methods is also recommended, alongside Conditional Access policies that require managed devices rather than relying solely on location signals.
(Editorial Team)
